filebeat 安装 + 配置

说明

公司业务日志系统是 ELK 的技术栈，每个机器都需要有 agent 来负责收集，filebeat 是比较不错的选择。

安装步骤

Ubuntu

curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.5.4-amd64.deb
sudo dpkg -i filebeat-6.5.4-amd64.deb

CentOS

curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.5.4-x86_64.rpm
sudo rpm -vi filebeat-6.5.4-x86_64.rpm

官方文档：
https://www.elastic.co/guide/en/beats/filebeat/index.html
https://www.elastic.co/guide/en/beats/filebeat/6.5/filebeat-installation.html

配置文件路径

/etc/filebeat/filebeat.yml

配置文件内容

filebeat.inputs:
# Nginx access log #
- type: log
  paths:
    - /www/wwwlogs/cloud-bj.yeelight.com.log
  fields:
    region: Beijing
    type: nginx-log

# Nginx error log #
- type: log
  paths:
    - /www/wwwlogs/cloud-bj.yeelight.com.error.log
  fields:
    region: Beijing
    type: cloud-error-log

# PHP error log #
- type: log
  paths:
    - /www/wwwlogs/php_errors.log
  fields:
    region: Beijing
    type: php-errors-log

# Laravel Framework log #
- type: log
  paths:
    - /www/wwwroot/cloud-manage/app/storage/logs/laravel-*.log
  fields:
    region: Beijing
    type: cloud-manage-laravel

  multiline.pattern: '^\['
  multiline.negate: true
  multiline.match: after

# Single log DAU #
- type: log
  paths:
    - /www/wwwroot/cloud-manage/app/storage/logs/single-log-*.log
  fields:
    region: Beijing
    type: single-log

output.logstash:
  hosts: ["192.168.0.63:5044"]

log 文件路径

/var/log/filebeat

filebeat 开机启动

vim /etc/rc.local

#!/bin/bash
/etc/init.d/filebeat start

chmod +x /etc/rc.local